Vibe Factory privacy policy

1. Who is responsible

NETZEN, operating under the Xexo brand, provides Vibe Factory. Contact us at hello@xexo.io for privacy questions, access requests, or deletion requests.

This policy covers the public Vibe Factory pages, NETZEN-operated Vibe Factory workspaces, and the Google integration described below. NETZEN is the controller for its website, account administration, support, and security information. When we handle project content on a customer’s instructions, the customer is generally the controller and NETZEN acts as its processor under the applicable agreement. If your organisation operates its own instance, it controls that instance’s storage, access, and retention; contact its administrator as well as us where relevant.

2. Website and workspace information

We process information you or your organisation submit to use and support Vibe Factory: contact details, project briefs, source code, files, prompts, discussion messages, task results, previews, and deployment settings. This may contain personal information. Connected services provide the resource identifiers, status information, and results needed for the features you enable.

Our servers and hosting providers may process IP addresses, browser information, request times, error details, and security logs to deliver and protect the service. Essential cookies or similar storage support authorisation flows and workspace preferences. These public product pages do not add advertising cookies or third-party analytics trackers.

3. Google permissions and data accessed

Connecting Google is optional. It begins when an authorised workspace user chooses Connect Google and approves Google’s permission screen. The current integration requests:

• Account identity and email: your Google account identifier and email address, to identify the connected account and show its connection status.
• Google Analytics editing access: account names and identifiers, property configuration, web data stream configuration, production website URLs, and measurement IDs. We use these to list accounts, select the intended account, find existing resources, and create a property or web stream for a production website when needed.
• Search Console management access: site URLs and property permission levels, to check your existing access and add production websites to Search Console.
• Site Verification access: website or domain identifiers, verification tokens, and verification results, to request and confirm ownership verification for a production domain.
• Authorisation credentials: access tokens used for API requests and a refresh token used to continue authorised work while you are away. We also store connection time, selected Analytics account, reporting time zone, currency, setup progress, and diagnostic outcomes.

The current integration configures website resources; it does not retrieve individual website visitors’ Analytics activity or Analytics reports. Any tracking that you later install on a project website is governed by that website’s own privacy notice, configuration, and consent arrangements.

4. How we use information and our legal bases

We use workspace information to deliver requested development and delivery features, maintain project history, respond to support requests, diagnose failures, and protect the workspace. Google data is used only to identify the connected account and provide the Google website-setup features described above. We do not sell Google user data, use it for advertising, or use it to train general-purpose AI or machine-learning models.

Where European data protection law applies, we rely on performance of our agreement or steps you request before an agreement, legitimate interests in maintaining reliable services and business relationships subject to your rights, legal obligations, and consent where required. Google OAuth approval authorises access to the permissions you grant. You may withdraw that authorisation at any time. If information or permission is needed for a feature and you do not provide it, that feature may be unavailable.

5. Storage and security

Google connection credentials, account details, and setup state are kept in server-side storage in the Vibe Factory instance. Credentials are subject to operating-system access restrictions. Short-lived access tokens are used for Google API calls; the saved refresh token enables later authorised calls. Project configuration retains the resulting resource identifiers and verification status.

Access is limited to authorised workspace operators and service providers who need it for the stated purposes. Connections to Google use HTTPS. Workspace users should protect their accounts, instance host, backups, and integration credentials. No transmission or storage system can be guaranteed completely secure; report suspected incidents to hello@xexo.io.

6. Sharing, AI features, and Limited Use

Google receives API requests needed to perform the actions you authorise. Your workspace’s authorised operators can view connection status and setup results. Hosting and infrastructure providers may process stored data to operate the instance under applicable confidentiality and data-protection obligations.

When domain verification is enabled through a connected DNS provider, the domain name and verification TXT token are sent to that provider. A published DNS verification record is publicly readable. The Google OAuth refresh token is not part of that DNS record.

Vibe Factory’s Google integration does not send Google user data to AI model providers. Separately, AI-assisted development can send project prompts, files, and other content selected for a task to the configured AI or development provider. Your organisation’s service configuration and agreement govern those tasks. Do not include Google credentials or personal information in prompts unless the relevant service and agreement expressly permit it.

Vibe Factory handles information received from Google APIs in accordance with the Google API Services User Data Policy, including its Limited Use requirements. Transfers of Google user data are limited to providing the user-facing features you request, security and abuse prevention, legal compliance, or a permitted business transfer with the required user consent. Human access to Google data is limited to your affirmative agreement for specific data, necessary security investigation, legal obligations, or permitted internal operations using aggregated and anonymised data.

We may disclose other personal information to professional advisers, authorities where legally required, or a business successor with appropriate safeguards. Google’s independent processing is described in the Google Privacy Policy.

7. Retention, disconnection, and deletion

The active Google connection is retained until an authorised operator disconnects it, replaces the connection settings, or asks us to delete it. Disconnect Google in Settings → Google removes the saved refresh token, Google account identifier, email, and cached account list from the active connection. It does not delete Google properties, web streams, Search Console registrations, DNS records, or previously stored project setup history.

You can separately revoke the Google grant at Google Account connections. Revocation prevents further authorised API access but does not itself erase information already stored in the workspace. To request deletion of stored account information, project setup records, or workspace content, contact your workspace administrator or email hello@xexo.io and identify the account and workspace concerned. Do not send passwords or tokens.

We retain remaining project records for the service relationship and operational needs, and support, security, and business records for as long as needed for their purposes, legal obligations, or claims. We assess the information’s sensitivity, contractual requirements, and statutory periods when determining retention. Information no longer needed is deleted or anonymised; backup copies expire under the applicable backup lifecycle and remain restricted in the meantime. We will explain any legal reason that prevents fulfilling a deletion request.

8. International processing

Hosting, Google, and other providers used for the service may process information outside your country, including outside the European Economic Area. Where required, we use an applicable adequacy decision or contractual safeguards, such as standard contractual clauses, and additional measures appropriate to the transfer. Contact hello@xexo.io for information about the providers, locations, and safeguards relevant to your workspace.

9. Your rights and choices

Depending on applicable law, you may request access, correction, deletion, restriction, or portability of your personal information; object to processing based on legitimate interests or direct marketing; and withdraw consent. These rights are subject to legal conditions. We may verify your identity and authority and will respond within applicable legal deadlines. For customer-controlled content, we may refer your request to the customer and assist it in responding.

You can complain to your local data-protection authority, including the authority where you live, work, or believe a breach occurred. European supervisory authorities are listed by the European Data Protection Board. Vibe Factory is intended for authorised adult business users and is not directed at children.

10. Changes and contact

We publish changes at this URL with an updated date and provide additional notice or seek consent when required. Before using Google data for a materially different purpose, we will provide an updated disclosure and obtain any required consent. For questions or requests, contact NETZEN, operating as Xexo, at hello@xexo.io.